[DependOnMe] Critical security fix - 1 issue(s) - #354
Open
dependonme-github-app[bot] wants to merge 2 commits into
Open
dependonme-github-app[bot] wants to merge 2 commits into
dependonme-github-app[bot] wants to merge 2 commits into
Conversation
![dependonme-bot[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Automatically regenerated by DependOnMe bot after package.json update. Branch: dependonme/bulk-fix-e51c736a Package manager: npm
dependonme-github-app
Bot
requested review from
matin-deriv,
mayuran-deriv and
nijil-deriv
as code owners
July 18, 2026 17:35
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bulk Security Fix
This pull request was automatically generated by DependOnMe to fix 1 critical security issue(s).
Issues Fixed
Files Modified
package.jsonAI Summary
Fixed 1 security issue:
CVE-2026-54466 —
websocket-driver: Message corruption via abuse of protocol length headers"websocket-driver": "0.7.5"to theoverridessection inpackage.jsonwebsocket-driverversions prior to0.7.5are vulnerable to message corruption attacks via malformed protocol length headers. An attacker could abuse this to corrupt WebSocket messages.overrides(consistent with the existing pattern in thispackage.json) to force all transitive consumers ofwebsocket-driverto use the patched version0.7.5. This is appropriate becausewebsocket-driveris a transitive dependency (used internally by packages likejest-websocket-mock→mock-socketand potentially webpack dev tooling), and there is no single root package upgrade that would resolve this across all dependency paths.0.7.5is a patch-level fix to the existing0.7.xline, maintaining full API compatibility.0.7.x → 0.7.5) with no breaking API changes. The fix only addresses the protocol length header parsing bug. The override pattern is already heavily used in this repository and is consistent with the existing maintenance approach.🧪 Testing Checklist:
npm install(ornpm ci) to regeneratepackage-lock.jsonwith the overridden versionwebsocket-driver@0.7.5appears inpackage-lock.json(no older versions should remain)npm testjest-websocket-mock)npm run buildto confirm the production build succeedsnpm run devand verify the development server starts correctlynpm auditto confirm the CVE is no longer flagged after the lock file is regeneratedManual Steps Required:
package.jsonchange, runnpm installto regeneratepackage-lock.jsonpackage.jsonand the updatedpackage-lock.jsonThis PR was created by DependOnMe - Automated Security Issue Management